All Rust, from the identity to the disk.

Spindle and gears live

Every service is a WebAssembly component, a gear, worn by Spindle, the runtime. Gears are grouped in gearboxes, one per platform, and a gear's callers are resolved against its own platform's core, so two platforms on one Spindle never share an identity. A gear holds only the grants its declaration names: which origins it may call, which variables it sees, which identity it may read or write. Spinning up a whole platform is placing a gearbox, not shipping a fleet of containers.

Rig, the builder live

Rig watches the forges, builds every push from source in a throwaway container, runs the lane (format, lint with warnings denied, tests), and deploys only what passed, through the host, one in flight per application. A newer push supersedes a running build. Every repository carries its own declaration of what it is and needs, as Rust, so infrastructure is code the compiler checks. Secrets live in Rig's vault and are handed to containers by name; Rig asks for every principal it places and never invents a value. building A merge queue so a red lane never lands on main, and dev, staging and production as gearbox placements for release management.

Canopy, the blueprint live

The blueprint of the whole estate: organisations, projects, components, what each holds, who stands for whom. Rig reads it and makes it true. A component's standing on its core is a record here, read live by the core, never a stored grant; the approvals a platform needs are carried by the blueprint, declared, not hacked in. Canopy is also the registry: every card names the release it was built on and the SDK it was built with.

Core, the identity live

Each platform owns its core. People sign in with passkeys; agents and services prove themselves with keys. An agent is bound into an organisation by an ask its owner decides on, with the terms locked in the ask: what it may do, for whom, until when. A person can opt a delegate past the safeguard so it stands as them, their standing whole, every act recorded as by it for them, and can retract it at any time. Secrets pass person to person as sealed, one-time sends, never through a chat. There is no admin back door: bootstrap keys are short-lived and the door closes when setup ends.

DnB, the storage building

Drum is the record engine and Bass the object store under it, one shape at every size: a spool embedded in a gear, a file under a service, the clustered store on the estate. The log is the truth: every change is an event, records are projections of the log, a migration rebuilds a projection, sync is replay from the last position, and offline is the normal case rather than a mode. Objects are content-addressed and verified on read.

• live Bucket and records, indexes, typed queries with in-store aggregates; Rig's own records and jobs run on it, Postgres retired from the builder.
• building Realtime watch and hooks, log retention bounds, the native pages-and-segments engine, per-aggregate events with declared conflict rules.
• planned S3 on both sides, erasure-coded resilience across nodes, clustering by placement with consensus only where money and entitlements demand it, storage tiers moved by policy, a mountable virtual file system where a row is a document and its blobs are the files beside it, and CRDT merging for structured data.

Trust, the Rust-smart build building

Cargo is a tool of Rig at every layer. A build never compiles a unit twice: the lane shares one target directory across the estate, restores file times so fingerprints hold across clones, and reports which units were rebuilt of how many. The artefact store is cargo-shaped inside, every unit by fingerprint, so a deploy is the same small compile and link a developer does locally. Declared toolchain, watched against Rust's own channel, upgraded as a declared change. planned Units as rows in DnB, distributed compile on farm nodes that mount a unit's inputs by fingerprint, one lane for every target from wasm to Apple silicon.

All-Rust AI building

The AI stack is pure Rust too. A Gemma engine on Apple Metal with its own kernels and quantisers and no Python, llama.cpp or MLX at runtime; a provider abstraction that treats an embedded model, a sidecar and a hosted API alike; a content-addressed model store with delta downloads. This is what lets a platform be agent-native without a customer's data leaving the building, which is the objection that ends most AI conversations in a studio.

Fabricator, the agent gear planned

The agent service is itself a gear. At setup the owner names Fabricator as a delegate and seals an AI provider key, or chooses an embedded model instead, so a fresh stack has its agent from the first minute. Fabricator runs the loop this stack was built with: read Rig's builds, deploys and faults, change the code, push, read the record again, write what was learned into the plan. Model-agnostic by design; held to the same laws, the same tests-before-shipping lane, the same record of every act. live The loop itself, today, is run by the founder with an AI agent holding its own bound principal.

Hosting methods and providers